# CVEs published 2022-06-17

56 CVEs were published on June 17, 2022: 4 critical, 9 high. Days are UTC.

- [CVE-2022-21503](https://cve.now/CVE-2022-21503.md): Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. (CVSS 4.9, Oracle Cloud Infrastructure)
- [CVE-2022-25871](https://cve.now/CVE-2022-25871.md): Prototype Pollution (CVSS 5.9, querymen)
- [CVE-2022-25852](https://cve.now/CVE-2022-25852.md): Denial of Service (DoS) (CVSS 7.5, pg-native · libpq)
- [CVE-2022-25872](https://cve.now/CVE-2022-25872.md): Out-of-bounds Read (CVSS 5.3, fast-string-search)
- [CVE-2022-22138](https://cve.now/CVE-2022-22138.md): Denial of Service (DoS) (CVSS 7.5, fast-string-search)
- [CVE-2022-21213](https://cve.now/CVE-2022-21213.md): Prototype Pollution (CVSS 7.5, mout)
- [CVE-2022-25345](https://cve.now/CVE-2022-25345.md): Denial of Service (DoS) (CVSS 7.5, @discordjs/opus)
- [CVE-2022-25856](https://cve.now/CVE-2022-25856.md): Directory Traversal (CVSS 7.5, github.com/argoproj/argo-events/sensors/artifacts · github.…)
- [CVE-2022-31874](https://cve.now/CVE-2022-31874.md): ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface. (no CVSS)
- [CVE-2022-31873](https://cve.now/CVE-2022-31873.md): Trendnet IP-110wn camera fw\_tv-ip110wn\_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi. (no CVSS)
- [CVE-2022-31875](https://cve.now/CVE-2022-31875.md): Trendnet IP-110wn camera fw\_tv-ip110wn\_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi (no CVSS)
- [CVE-2022-31876](https://cve.now/CVE-2022-31876.md): netgear wnap320 router WNAP320\_V2.0.3\_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies (no CVSS)
- [CVE-2022-31941](https://cve.now/CVE-2022-31941.md): Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \\rdms\\admin?page=user\\manage\_user&id=. (no CVSS)
- [CVE-2022-31083](https://cve.now/CVE-2022-31083.md): Authentication bypass in Parse Server Apple Game Center auth adapter (CVSS 8.6, parse-community parse-server · parse-server)
- [CVE-2022-29496](https://cve.now/CVE-2022-29496.md): A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. (CVSS 9.0, Blynk-Library)
- [CVE-2022-21806](https://cve.now/CVE-2022-21806.md): A use-after-free vulnerability exists in the mips\_collector appsrv\_server functionality of Anker Eufy Homebase 2 2.1.8.5h. (CVSS 10.0, Anker Eufy Homebase)
- [CVE-2022-21184](https://cve.now/CVE-2022-21184.md): An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. (CVSS 5.9, Bachmann Visutec Atvise)
- [CVE-2022-30422](https://cve.now/CVE-2022-30422.md): Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the View (no CVSS)
- [CVE-2022-32442](https://cve.now/CVE-2022-32442.md): u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-30607](https://cve.now/CVE-2022-30607.md): IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensi (CVSS 2.7, IBM Robotic Process Automation)
- [CVE-2022-22485](https://cve.now/CVE-2022-22485.md): In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the ad (CVSS 5.9, IBM Spectrum Protect Server)
- [CVE-2022-32444](https://cve.now/CVE-2022-32444.md): An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to a (no CVSS)
- [CVE-2021-40903](https://cve.now/CVE-2021-40903.md): A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. (no CVSS)
- [CVE-2022-31246](https://cve.now/CVE-2022-31246.md): paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). (no CVSS)
- [CVE-2022-31355](https://cve.now/CVE-2022-31355.md): Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=. (no CVSS)
- [CVE-2022-31356](https://cve.now/CVE-2022-31356.md): Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-31357](https://cve.now/CVE-2022-31357.md): Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=. (no CVSS)
- [CVE-2020-36549](https://cve.now/CVE-2020-36549.md): GE Voluson S8 Windows Operating System Patches privileges management (CVSS 8.8, GE Voluson S8)
- [CVE-2020-36548](https://cve.now/CVE-2020-36548.md): GE Voluson S8 Service Browser users.cgi improper authentication (CVSS 5.9, GE Voluson S8)
- [CVE-2020-36547](https://cve.now/CVE-2020-36547.md): GE Voluson S8 Service Browser hard-coded credentials (CVSS 5.9, GE Voluson S8)
- [CVE-2022-31296](https://cve.now/CVE-2022-31296.md): Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view\_post.php. (no CVSS)
- [CVE-2019-12352](https://cve.now/CVE-2019-12352.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12353](https://cve.now/CVE-2019-12353.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12354](https://cve.now/CVE-2019-12354.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12355](https://cve.now/CVE-2019-12355.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12356](https://cve.now/CVE-2019-12356.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12357](https://cve.now/CVE-2019-12357.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12358](https://cve.now/CVE-2019-12358.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12359](https://cve.now/CVE-2019-12359.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2021-45026](https://cve.now/CVE-2021-45026.md): ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-45025](https://cve.now/CVE-2021-45025.md): ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of (no CVSS)
- [CVE-2021-45024](https://cve.now/CVE-2021-45024.md): ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity ( (no CVSS)
- [CVE-2022-31784](https://cve.now/CVE-2022-31784.md): A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow (no CVSS)
- [CVE-2022-32276](https://cve.now/CVE-2022-32276.md): Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/\*?orgId=0 URI. (no CVSS)
- [CVE-2021-41490](https://cve.now/CVE-2021-41490.md): Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior. (no CVSS)
- [CVE-2022-2113](https://cve.now/CVE-2022-2113.md): Cross-site Scripting (XSS) - Stored in inventree/inventree (CVSS 8.4, inventree/inventree)
- [CVE-2022-2112](https://cve.now/CVE-2022-2112.md): Improper Neutralization of Formula Elements in a CSV File in inventree/inventree (CVSS 9.0, inventree/inventree · inventree)
- [CVE-2022-2111](https://cve.now/CVE-2022-2111.md): Unrestricted Upload of File with Dangerous Type in inventree/inventree (CVSS 9.0, inventree/inventree · inventree)
- [CVE-2021-41408](https://cve.now/CVE-2021-41408.md): VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter. (no CVSS)
- [CVE-2022-33915](https://cve.now/CVE-2022-33915.md): Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that co (CVSS 7.0)
- [CVE-2022-33912](https://cve.now/CVE-2022-33912.md): A permission issue affects users that deployed the shipped version of the Checkmk Debian package. (no CVSS)
- [CVE-2018-25044](https://cve.now/CVE-2018-25044.md): uTorrent Guest Account privileges management (CVSS 6.3, uTorrent)
- [CVE-2018-25043](https://cve.now/CVE-2018-25043.md): uTorrent PRNG improper authentication (CVSS 5.0, uTorrent)
- [CVE-2018-25042](https://cve.now/CVE-2018-25042.md): uTorrent memory corruption (CVSS 5.0, uTorrent)
- [CVE-2018-25041](https://cve.now/CVE-2018-25041.md): uTorrent JSON RPC Server privileges management (CVSS 6.3, uTorrent)
- [CVE-2018-25040](https://cve.now/CVE-2018-25040.md): uTorrent Web HTTP RPC Server privileges management (CVSS 6.3, uTorrent Web)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.